Form builder
Runs on WordPressContact Form 7 spam: change Mail → To, nothing else
Leave the "From" and "Additional headers" fields exactly as they are. Only the To address changes.
Replace whatever is in that field with the address Humainbox generates for you. Nothing else changes: no plugin, no snippet, no DNS record, and nothing on your site to republish. If you want to stop, put your old address back in that field.
Mail
To
change thisFrom
[your-name] <[email protected]>
Subject
[your-subject]
Additional headers
Reply-To: [your-email]
Why it is getting through
What Contact Form 7 already stops — and where it stops
Contact Form 7 runs on a very large share of WordPress sites, which makes its markup one of the easiest things on the web to recognise and aim at. What arrives fills every required field, clears the quiz tag if you set one, and reads like a person right up until you notice four of them this week, different names, same service.
Contact Form 7 ships no real spam filtering of its own — a quiz field, and that is the list. What it has instead is integration: Akismet, and reCAPTCHA v3. reCAPTCHA v3 never shows a challenge; it scores how human the session looked and Contact Form 7 rejects below a threshold. Somebody sitting in an ordinary browser pasting in a paragraph a model wrote scores like a person, because for that half of it they are one.
What Contact Form 7 keeps either way
Nothing. Contact Form 7 keeps no record of a submission — the notification email is the record. Flamingo, from the same author, adds storage; without it, if the mail does not arrive, nothing does.
We check the message itself
A captcha asks whether the sender is a machine. We ask whether the writing could only have been sent to you.
Nothing is deleted
Held mail stays readable in the panel for your whole retention window, and one click sends it on.
If we break, your mail still arrives
If anything breaks on our side, mail goes through. You get the noise back for an afternoon; you never lose an enquiry.
Questions
Contact Form 7, specifically
The ones that come up about this builder rather than about us. If yours is not here, ask it — a person answers.
Does reCAPTCHA v3 not already stop this?
reCAPTCHA v3 answers a different question. It scores the session — the browser, the mouse, the history — and returns a number Contact Form 7 compares to a threshold. It never asks what was written. A real browser driven by a real person, pasting in text a model generated, is a high score and a spam submission at the same time.
Contact Form 7 keeps no copy. What happens to a held message?
It stays readable in the Humainbox panel for your whole retention window, and one click sends it on to you. This matters more on Contact Form 7 than anywhere else, precisely because the email is the only record — which is also why nothing is deleted at our end, and why mail goes through rather than stopping if anything breaks on our side. You get the noise back for an afternoon; you do not lose an enquiry.
Do I change the From field or Additional headers too?
No — leave both exactly as they are. From is what makes the notification pass your own domain's checks, and the Reply-To in Additional headers is what lets you answer the visitor directly from your mail client. Only To changes.
What about the second template, Mail (2)?
That is the autoreply to whoever filled the form in, and it should keep pointing at them. Only the notification addressed to you goes through Humainbox.
Can I try it on one form and leave the others?
Yes. Every Contact Form 7 form has its own Mail tab, so moving one and watching it for a week costs you nothing on the rest.
Not sure what is already running on your contact page? Paste it into the free check and we will name the builder, the CAPTCHA and what your DNS says. No account, nothing stored.
Cannot find it on your Contact Form 7?
Menus move between versions, themes hide panels, and an agency may have built something on top of the standard one. Send us the address of your contact page and we will look at the install you have rather than the one this page was written about. A person reads it, and replies within a day.
And if the person who can change that field is not you, Humainbox writes to them instead — the field, the address, and nothing else to read.
Checked against Contact Form 7’s own documentation
Using something else?
If a form can send its notification to an address you choose, it works, whether or not it is on this list.
